Data exposure

No public /phpmyadmin/

Configuration files, backups and source code that should never be public.

Why it matters

Administration logins on the open internet are found by scanners within hours and attacked with password lists and published exploits. One weak or reused password gives an attacker the database or the server.

How to fix it

Quick fix · under 1 hour

Remove the tool if it is not needed (database tools are often left over from setup).
Otherwise restrict the path to trusted IP addresses or put it behind a VPN or SSO.
Use a unique, long password and keep the tool updated.

nginx (allow one address)

location /phpmyadmin/ {
    allow 203.0.113.10;
    deny all;
}

Apache

<Location /phpmyadmin>
    Require ip 203.0.113.10
</Location>

How we test it

The check runs from the public internet as part of every scan, read-only and without touching your data. If it fails, your report shows the evidence that proves it - the record, header, file or banner we observed - together with the fix above, tailored to the issue we found.

Does your domain pass this check?

Run all 97 checks in about a minute. Your first scan is free, with the complete fix for your most urgent finding.

Scan your domain free